8. The Europol Drugs
Unit (the "EDU"), the precursor to Europol, was established
by Ministerial agreement in 1993 and became operational in 1994.
Based in the Hague, its mandate has been extended[4]
and its workload has grown. The core business of the EDU is the
exchange of information and intelligence by the European Liaison
Officers (ELOs) seconded to the EDU from the national enforcement
agencies. The United Kingdom has two ELOs, a customs officer and
a police officer. In 1997, the EDU responded to over 9000 enquiries
from Member States, an increase of 40% compared to the level in
1996. Drugs have continued to account for the majority (over 60%).
Money laundering occupies second place (19%) but the numbers of
enquiries relating to illegal immigration networks and trafficking
in human beings has increased. Some 474 enquiries (out of a total
of 2608) emanated from the United Kingdom.[5]

9. The EDU has no formal
external relations and has no official arrangements for the exchange
of information with parties outside the Union. It has, however,
had informal contacts with non-Union States and bodies. Visits
have taken place. The EDU has also held conferences in which representatives
of the Central and Eastern European countries (CEECs) currently
seeking membership of the EU have participated (Q 6).

10. The National Criminal
Intelligence Service (NCIS)[6]
has been involved with the development of the EDU and is the designated
national unit for the United Kingdom under the Europol Convention.
NCIS has a Europol Policy Unit which represents it at all policy
meetings at Europol and at EU Working Groups. The Europol Policy
Unit provides a central point of reference for all United Kingdom
law enforcement agencies and collates and disseminates related
information internally and to other Member States. NCIS maintains
bilateral relations with other EU States and more widely. Mr Abbott,
the Director General of NCIS, said: "Our experience with
serious and organised crime is that it is a global problem and
consequently our enquiries and developments take us throughout
most quarters of the world" (QQ 59, 62).

14. Europol 26 deals
with agreements with "bodies linked to the European Union"
(i.e. those mentioned in points 1-3 of Article 10(4)).
The legal base is Article 42(1) of the Convention.[7]
The Home Office identified UCLAF (the European Commission's Anti-Fraud
Unit) and the Drugs Monitoring Centre in Lisbon as being EU bodies
with whom Europol might conclude an agreement. There might be
others[8], particularly
when the Schengen Agreement has been incorporated into the EU
under the Treaty of Amsterdam. Ms Joyce Quin MP, Minister of State
at the Home Office, said: "it certainly seems logical to
us that Europol should have links with systems such as the Schengen
Information System[9] for
practical reasons to avoid duplication and to ensure that resources
devoted to tasks which both are interested in are used efficiently".
She referred to the System's database on stolen vehicles as an
example of where information might usefully be shared (QQ 10,
13, 200).

16. When the Convention
was signed in 1995 a declaration was added by the Council that
"Europol should as a matter of priority establish relations
with the competent bodies of those States with which the European
Communities and their Member States have established a structured
dialogue". The Home Office explained that consequently agreements
with the ten CEECs and Cyprus would be the priorities[11].
Mr Cullen (of the Europa Institute, University of Edinburgh) thought
that Europol would have an important role to play in helping to
prepare applicant countries to accept certain parts of the acquis
concerning the combating of organised and other forms of transnational
crime (p 45). From NCIS's viewpoint, the applicant countries,
particularly because of their geographical proximity, were also
a primary target (Q 79).

17. As priorities beyond
the applicant countries, the Home Office identified the United
States, Canada, Russia and Japan. There were also other European
countries, such as Switzerland and Norway and Iceland, the last
two being States associated with Schengen (Q 14). Mr Abbott (NCIS)
said that it would be appropriate to identify those areas where
there was the greatest need, where there were proven links with
criminal activity (Q 79).

18. As regards agreements
under Europol 29 with non-EU bodies, the Convention expressly
refers to Interpol (Article 10(4) point 7). The EDU already has
had a dialogue with them to see how, in the future, Europol might
be able to agree co-operation on such matters as technical standards
(Q 9). Mr Abbott explained that current arrangements often took
NCIS via Interpol, though the latter did not always operate speedily:
"Interpol is a valuable organisation, it is an organisation
of 177 countries, not all 177 countries have the same capability
as others". Mr Abbott did not think that Europol would replace
Interpol even as regards relations between the EU Member States.
Interpol's mandate was a wider one. He thought it "very important
that we ensure that we work out the ground rules so we are quite
clear on what Interpol is going to do and what Europol is going
to do". NCIS also wanted to retain the operational flexibility
to use Interpol and bilateral arrangements, though the expansion
of Europol might in time minimise the use of bilaterals (QQ 81-89).

19. The Home Office
also pointed to the World Customs Organisation[12]
and said that within the UN structure there were a number of bodies
active in the drugs and crime prevention field with whom there
might also be agreements (Q 15).

23. The Director[16]
of Europol may transmit non-personal data subject to the basic
protection level

- to bodies linked to the EU,
where, "in the case of particular data, the Director of Europol
considers that the protection of such data is guaranteed by the
European Union body" (Article 7(2) of Europol 26).

- to third States and bodies
not linked to the EU, "exceptionally, when the Director
of Europol considers such transmission absolutely necessary to
safeguard the essential interests of the Member States or to prevent
imminent criminal danger" (Article 8(2) of Europol 29).

24. The Home Office
said that the Director's powers were limited to basic protection
level data. The reference in Article 7(2) of Europol 26 to data
protection being "guaranteed" by the EU body avoided
spelling out precisely what data protection regime applied. The
EC Data Protection Directive did not apply to law enforcement
bodies and as yet there was no common standard for data protection
in Third Pillar institutions and bodies, though the possibility
of having a common standard had been mooted. The Minister welcomed
the recent Italian initiative that work should be undertaken to
identify possible inconsistencies and to examine possibilities
for achieving greater harmonisation and avoiding duplication of
effort. The Council Legal Service had been asked to prepare a
paper looking at the different data protection regimes in Third
Pillar instruments and reporting any differences. The Council
would look at the question again when it had that information.
(QQ 36-37, 203).

25. The circumstances
in which the Director can supply data to third States and non-EU
bodies (Article 8(2)) are reiterated as regards personal data
in Article 2 of Europol 27. The Standing Committee of experts
on international immigration, refugee and criminal law (a Dutch
body sometimes known as the Meijers Committee) was critical of
these two provisions. Both Articles appeared to circumvent the
need for the prior authorisation of the Council for agreements
enabling transmission of data to third States. Secondly, there
was a danger that the provisions in the Rules designed to ensure
a proper procedure for data transmission would be bypassed, leading
to deterioration in the level of data-protection (p 47). We return
to these provisions, and the extent of the Director's discretion,
at paragraphs 48-50 below.

27. The transmission
of data revealing racial origin, political opinions or religious
or other beliefs, or concerning health or sexual life is limited
to "absolutely necessary cases" (Article 6). The Home
Office explained that the categories of data listed were those
identified as requiring special treatment[18]
in the Council of Europe Convention for the Protection of Individuals
with regard to Automatic Processing of Personal Data of 28 January
1981 ("the 1981 Council of Europe Convention"). Mr Wrench
said: "It is difficult to have hard and fast rules on this
and hence the use of the phrase `absolutely necessary'. But I
think that when, for example, Europol's mandate is extended to
deal with terrorism; and when Europol is dealing with trafficking
of human beings, with organised paedophile activity across borders;
then those are the sorts of cases where political opinions and
sexual orientation are highly relevant to what Europol would be
doing" (Q 35).

38. As to what might
be expected of third States and bodies, Mr Wrench (Home Office)
said that the 1981 Convention "certainly provides a benchmark
... of the sorts of standards one would be looking for. However,
I think it will have to be defined case-by-case according to (a)
which country it is and (b) how intense a level of co-operation
of a particular agreement it envisages" (Q 16). Justice,
however, remained concerned that the imperatives of crime prevention
would distort the judgment of the Management Board in these matters
(Q 171).

39. The Home Office
considered that the United States, for example, had a sufficient
level of protection in place to enable a close relationship (Q
17). Justice questioned this, contending that there was no comprehensive
data protection legislation and independent supervision there.
Justice said: "It is clear from this that there is no underlying
assumption that data protection in the USA is "adequate"
by the standards set by the [EC Data Protection] directive. We
would question any assertion that exchanges with US enforcement
bodies are unlikely to require special conditions" (p 28).
The Data Protection Registrar expressed similar concerns about
the position as regards the United States: "We are having
some difficulty in relation to First Pillar issues in deciding
whether we consider the United States to offer adequate protection,
so we would certainly have concerns in relation to Third Pillar
issues". She described the great care and detail with which
the undertaking of certain fingerprint recognition processing
in Tacoma, Washington State, on behalf of United Kingdom agencies
had recently been negotiated. But as regards Europol, the Registrar
concluded that though there would have to be careful consideration
of the necessary safeguards, which provide equivalent if not identical
arrangements, to be put in place "it would be a strange situation
if we found ourselves unable to make some arrangements which allowed
some transfer of traffic between Europe and the United States
for law enforcement purposes" (QQ 156-60, 162).